Skill UI

This skill provides comprehensive scripts and workflows to automatically identify and remove unused AWS resources across multiple services (EBS, S3, EC2, EIPs). By automating the cleanup of orphaned volumes, old snapshots, and stale data, users can eliminate cloud waste, significantly optimizing their AWS expenditure and ensuring a cost-efficient infrastructure.

Parses Cobalt Strike malleable C2 profiles via pyMalleableC2 to pull beacon configs, HTTP communication patterns, sleep/jitter settings, and combines JARM scans for C2 detection when hunting suspected infrastructure or building IDS signatures.

This solution automates the processing of AWS GuardDuty findings using EventBridge and AWS Lambda. It enables real-time incident response capabilities, including automatic quarantine of compromised EC2 resources, comprehensive forensic snapshot creation, and immediate high-severity security notifications via SNS. Ideal for SOC teams seeking to drastically reduce Mean Time To Response (MTTR) and strengthen cloud security posture.

This guide teaches security teams how to deploy and operationalize Amazon GuardDuty for continuous, comprehensive threat detection across entire AWS accounts and workloads. It covers enabling protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting various finding severity levels, and building robust, automated incident response playbooks using EventBridge and AWS Lambda for immediate containment actions.

A comprehensive guide for security teams on detecting and responding to unauthorized crypto mining operations in cloud environments (AWS, Azure). It details a multi-layered approach, utilizing cost anomaly detection, compute utilization monitoring, GuardDuty findings, and network flow log analysis (VPC/KQL) to identify resource hijacking attempts and suspicious activity across EC2, ECS, and EKS workloads.

This utility implements comprehensive Cloud Workload Protection (CWPP) by monitoring compute workloads on cloud instances (EC2/GCE). It provides runtime security controls, detecting process anomalies, unauthorized binary execution, cryptomining activity, and suspicious network connections using AWS and Google APIs. Ideal for establishing robust security postures and meeting compliance requirements.

A comprehensive guide and workflow for performing authorized penetration testing on AWS environments using the open-source Pacu framework. This skill covers enumerating IAM configurations, identifying privilege escalation paths, testing credential harvesting, and validating security controls across S3, EC2, Lambda, and Secrets Manager. It is designed for red team exercises and risk assessment when auditing cloud infrastructure security.

This workflow systematically analyzes deployed AWS resources and Infrastructure-as-Code (IaC) definitions. It collects usage metrics from CloudWatch and Cost Explorer to identify over-provisioning, unused resources, and inefficient configurations (e.g., right-sizing EC2, S3 lifecycle policies). It generates actionable cost optimization recommendations and creates structured GitHub issues for tracking and implementing savings.

This comprehensive workflow analyzes the health status of various AWS resources (EC2, Lambda, RDS, DynamoDB, etc.). It uses AWS CLI to diagnose potential issues by analyzing CloudWatch logs, metrics, and performance data. The process culminates in classifying root causes and generating actionable, tiered remediation plans (Immediate, Short-term, Long-term) to ensure system resilience and stability.

This skill allows users to query the current state of various AWS resources (including EC2, S3, Lambda, RDS, VPC, etc.) using natural language. It translates user intent into strictly read-only AWS CLI commands (e.g., `describe-*`, `list-*`). Crucially, this tool can only view data and is contractually incapable of performing any write, modify, delete, or mutation actions, ensuring maximum safety.

This guide teaches security teams how to proactively detect and respond to unauthorized cryptocurrency mining operations across major cloud platforms (AWS, Azure). It utilizes a multi-layered approach by analyzing compute cost anomalies, monitoring GuardDuty findings, inspecting network traffic to known mining pools, and analyzing runtime process execution in EC2, ECS, and EKS environments.